(alg:craftmalicious)
Inspired by Jagielski et al. [1]}, we construct an input designed to poison the ML model.
Given access to samples from the underlying data distribution,
the adversary trains a set of shadow models (e.g., as done in [2]}). The adversary trains shadow models using the same hyperparameters as the model trainer will use, which allows adversary to approximate how model trainer's model will behave.
Next, the adversary generates an input with an adversarial example algorithm [3]}.
If a model trains on that input, the learned model be different from a model which is not trained on that input. alg:craftmalicious summarizes the algorithm.
